Gen.Variant.Kazy.563826_d990834ade

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:936

The Trojan injects its code into the following process(es):

hEMQMIQs.exe:1864
hmwooYMM.exe:876
zuMEoUcg.exe:308

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process hmwooYMM.exe:876 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\NAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
\\XP4\PIPE\srvsvc (72 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
C:\totalcmd\TcUsbRun.exe (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process %original file name%.exe:936 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe (7785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OneDriveSetup.exe (42363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zAkAMAAw.bat (4 bytes)
%Documents and Settings%\All Users\xWAMIgUE\zuMEoUcg.exe (7737 bytes)
%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe (7737 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zAkAMAAw.bat (0 bytes)

Registry activity

The process hEMQMIQs.exe:1864 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 3F FC 4E 83 9A 1A 79 D5 C2 E7 49 95 D1 81 A6"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

The process hmwooYMM.exe:876 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 B8 D7 E8 33 D3 A4 D6 9A 6B 45 61 3A D3 C7 B1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hmwooYMM.exe" = "%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe"

The process zuMEoUcg.exe:308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 87 FC 16 B5 24 91 0E CC EC C1 8A 25 6D 33 94"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

The process %original file name%.exe:936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 40 DE 6A 18 ED 7A 20 53 47 1D AE A4 58 5F 74"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe,"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hmwooYMM.exe" = "%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"

Dropped PE files

MD5	File path
a6f19a33362cd15595ab40b050900ee4	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
049f00a3a4e2af1859abc63578bc980b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
82620cc004dafcc4ade3cea8117992ec	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
24252371ef07823bbf7f8b1649bb58e8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
b269f3388b0b14fbf92caa1e1a105336	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
00ea9c93f4649187a81e2de656162934	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
53a1603c1657ec29e5e8911457d14582	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
76a0960336e843539b2c2fe4fbfc682c	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
1f672abd175ea551064bd92ec767c8e9	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
ad31236d7863815b7101c00a8e55529f	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
ef3de40deced9daed63f84cf037261ed	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
a208a2bf7e7bcf7490add968f95a6e49	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
8161ae191e7c4e2e0929593db91060bf	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
82df425a98655dcebadafb09fedbbd67	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
480787a1a9ab1bd6f9152a0bd1af40ff	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
dd256551ead024ef9e34d5df1af2a85d	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
5a71aa665de47545076ee4478dc6291b	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
08b9e1eb636cff50dd50620eef3dcdb2	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
f2640dea09c65b0e833f3cc82daf5146	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
1fdb8d4610ec1c642e9ca32201d3e4fd	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
df79b31ab30cce74f49e186955d12a62	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
77fb9c03ca95a442c1067d0c281eb9c8	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
8fd32c3aea0fcf7da632dc5ca8cada81	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
5a28531bf048d53dffefb10c74c86f30	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe
f931ba6f438c76f3e592d50ce06215f5	c:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
c9fc44a407dd2864959d8484015e5036	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
55fe79ddc7a46a9498df87bd7817fdcb	c:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
f677b336c40bc233bebe636e68822621	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
588c1d7d580065c6e52a9595f7118f4d	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
cd2dec87a1cc1d51e4d09bdaa84970d7	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
8edad6c6f2a4abc3429f8ea0a2c670de	c:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
16ef4b45e372bb0a7a86ca9a3ad73af6	c:\Documents and Settings\All Users\JUsIccwo\hEMQMIQs.exe
e157ffec9f5809597295a9c78b252cce	c:\Documents and Settings\All Users\xWAMIgUE\zuMEoUcg.exe
8d7a1204cc0086fde7c3c3a08d1840c9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\OneDriveSetup.exe
81f4a5d33ff100f9d8a7075e642502f7	c:\Documents and Settings\"%CurrentUserName%"\tiMscAww\hmwooYMM.exe
48757a8282c4bf3dde8a65cec6f4ebc1	c:\Perl\eg\IEExamples\ie_animated.gif.exe
95d7a2ed377cc2d401ff62127fc64cc1	c:\Perl\eg\IEExamples\psbwlogo.gif.exe
952a446d9143eaa58dfaa081ee3fe1cb	c:\Perl\eg\aspSamples\ASbanner.gif.exe
747fd2f8ad8da9236380df5c881618ff	c:\Perl\eg\aspSamples\Main_Banner.gif.exe
924cc30eb2f3fc5393ea32819c8f22f1	c:\Perl\eg\aspSamples\psbwlogo.gif.exe
bae9702a770f7bfd4b9399e8709ef27a	c:\Perl\html\images\AS_logo.gif.exe
06f5e8b198bbdb66fb7a54786e6d46ee	c:\Perl\html\images\PerlCritic_run.png.exe
1deeb3397c9247fb2b4d7a88a413d670	c:\Perl\html\images\aslogo.gif.exe
a5ee3b0062bea11d9f3ef8f8bad36e2d	c:\Perl\html\images\ppm_gui.png.exe
7b245f2d8ed670d45a5dcd44b6d538b0	c:\Perl\lib\ActivePerl\PPM\images\gecko.png.exe
ce98ff958fa20d47d41feb5b3d872ee5	c:\Perl\lib\ActivePerl\PPM\images\perl_48x48.png.exe
18bf417f1d028a1b65dcb6d62b9350e2	c:\Perl\lib\Devel\NYTProf\js\asc.png.exe
95da3a78fc7709553f2c3bc25dbb7b87	c:\Perl\lib\Devel\NYTProf\js\bg.png.exe
e2b3c7ed792072ebe82f8685f8ee7847	c:\Perl\lib\Devel\NYTProf\js\desc.png.exe
f5e76ba06b70ea05531a3833aca6ecf4	c:\Perl\lib\Devel\NYTProf\js\jit\gradient.png.exe
46e15d0677947dfbdcaf1d57891235f9	c:\Perl\lib\Devel\NYTProf\js\jit\gradient20.png.exe
48d6d2577e00faf47cba411a07bdd5ce	c:\Perl\lib\Devel\NYTProf\js\jit\gradient30.png.exe
ad404c9280d2092aceedc5141e140e5e	c:\Perl\lib\Devel\NYTProf\js\jit\gradient40.png.exe
08a3a8a7ff95ec0f70bb6796aa892c60	c:\Perl\lib\Devel\NYTProf\js\jit\gradient50.png.exe
29e150e23cea9add6d16a3a5e3b9b95c	c:\Perl\lib\Mozilla\CA\cacert.pem.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:936

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (11518 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\NAAo.txt (55978 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (7385 bytes)
   C:\totalcmd\TOTALCMD.EXE.exe (35505 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (7385 bytes)
   C:\totalcmd\TCMADMIN.EXE.exe (7433 bytes)
   C:\totalcmd\TCUNINST.EXE.exe (7385 bytes)
   \\XP4\PIPE\srvsvc (72 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (7433 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (7433 bytes)
   C:\totalcmd\TCMDX32.EXE.exe (7433 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (7433 bytes)
   C:\totalcmd\TcUsbRun.exe (7385 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (7971 bytes)
   %Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (10177 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (7385 bytes)
   %Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (7385 bytes)
   %Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe (7785 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\OneDriveSetup.exe (42363 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\zAkAMAAw.bat (4 bytes)
   %Documents and Settings%\All Users\xWAMIgUE\zuMEoUcg.exe (7737 bytes)
   %Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe (7737 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "hEMQMIQs.exe" = "%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "hmwooYMM.exe" = "%Documents and Settings%\%current user%\tiMscAww\hmwooYMM.exe"
   
   

5. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "UserInit" = "%System%\userinit.exe,%Documents and Settings%\All Users\JUsIccwo\hEMQMIQs.exe,"

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	7004160	7002112	5.51722	b6b7ae62d4c12ef5e0d74f08c2e63d98
.rdata	7008256	4096	512	2.47775	d99d730ddb1f89412cd40b049070d134
.data	7012352	4	512	0.056519	23db6963e812f3bd1bf83cd37daa4a3c
.rsrc	7016448	4444	4608	2.1494	6de4d68a0afe95d9d644645fd5f59ce9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps